Guest Post | Advt | Query:

Analysts Reveal Link to Commercial Spyware for Surveillance of Journalists and Activists

The Citizen Lab Works with United Arab Emirates Human Rights Defender, Ahmed Mansoor, to identify Exploit Infrastructure with RiskIQ PassiveTotal

LONDON, UK – March 28, 2017RiskIQ, the leader in digital threat management, today revealed that its intelligence and external threat investigation system, RiskIQ PassiveTotal™, was a critical tool used by the interdisciplinary research group, The Citizen Lab, in the discovery of commercial spyware linked to NSO Group that targeted the mobile phones of United Arab Emirates (UAE) human rights activists.

RiskIQ logo
“When we joined RiskIQ in 2015, we did so with the intent to improve critical research so analysts could more efficiently hunt digital threats and proactively defend their organisations,” said Brandon Dixon, vice president of product at RiskIQ and co-creator of PassiveTotal. “We design our products for situations exactly like this, but it is extremely rewarding to hear that we’ve influenced positive change in the fight for privacy and human rights.”

In an operation named “Stealth Falcon,” The Citizen Lab leveraged PassiveTotal’s broad array of internet data sets and advanced correlation technologies, querying a series of IP addresses used by threat actors targeting UAE human rights activists. A query returned a related domain, as well as an email address that differed from known Stealth Falcon infrastructure. Pivoting across relevant PassiveTotal data sets, The Citizen Lab connected the email and domain to a domain that was registered to NSO Group. Suspecting that these domains were part of an exploit delivery infrastructure, they began seeking evidence of messages containing links to the network.

Months later, renowned human rights defender, Ahmed Mansoor, one of the UAE Five, shared two text messages with The Citizen Lab containing links identified as part of the exploit infrastructure. The Citizen Lab was able to successfully trigger the exploit infrastructure to fire against a device and captured the payload. This led to the discovery of a remote jailbreak using a string of zero-days prompting worldwide attention and an iOS security update from Apple. Ultimately, using PassiveTotal, The Citizen Lab connected the domain registration information from an initial phishing e-mail to a range of other malicious and fake news websites.

“Analysts at The Citizen Lab have been using PassiveTotal in investigations since the very first beta of the platform in 2014. Tools like PassiveTotal help us punch above our weight. Its ease of use, rich data set, and ongoing evolution of its features make it an excellent tool for our research, and a benchmark that we compare other options against,” said Masashi Crete-Nishihata, research manager, The Citizen Lab.

To learn more about how RiskIQ PassiveTotal to support investigations that contribute to the public good, please read RiskIQ’s blog post, RiskIQ’s PassiveTotal: Enabling The Citizen Lab Investigations.

To read the related case study about the work with The Citizen Lab, please visit

About RiskIQ
RiskIQ is the leader in digital threat management, providing the most comprehensive discovery, intelligence, and mitigation of threats associated with an organization’s digital presence. With more than 80 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social, and mobile exposures. Trusted by thousands of security analysts, RiskIQ’s platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk, and take action to protect business, brand, and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners, and MassMutual Ventures. Visit

Try RiskIQ Community Edition for free by visiting

About The Citizen Lab
The Citizen Lab is an interdisciplinary research group at the Munk School of Global Affairs, University of Toronto, that investigates targeted digital espionage operations against civil society groups. The group is dependent on the generous support of cyber security companies to help them access and work with threat intelligence products for their research.

Have any Question or Comment?

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Twitter @TechRecur

…… ……. … …

……… …. …….



For the 2012 MLB period, we found an totals forecast Joao’s Renowned Over/Under João Zorro Gonçalves, Zcode Totals Pro, System of the time with progressions that have been successful over 98 98% ... We eventually perfected our over/under program ( Zcodesystemexclusive ), although it h-AS has brought years of investigation. Five Steps to Making a Winning MLB Method: 1. Execute appropriate cash management tools. 2. MLB rules that are comprehend. 3.Extensive testing back to make sure successful longterm results ...


There is always a challenge when you're dealing with the Foreign Exchange Market. That's just the nature of the beast. The best thing you can do is to learn about how the market operates as a whole so that you will be ready to meet these challenges. iq option penipu Never be misled by any profit gains in binary options. This is the number-one way traders end up losing their money and ultimately failing. Remember that the same things that make you laugh can make you cry in this market, and you can lose that $700.


Learning Polish has never been this fun and easy as with our podcasts Learn Polish with Polishpod101 Start today and become conversational in Polish in no time


The Best Website Agen Poker Resmi Terpercaya come join
Do you need edmonton phone systems service ? Call complete communications today!

……… ……… .

High-tech solutions for easy start-up of your IPTV/OTT-business